import urllib2
import sys

TARGET = 'http://crypto-class.appspot.com/po?er='
#--------------------------------------------------------------
# padding oracle
#--------------------------------------------------------------
def strxor(a, b):     # xor two strings of different lengths
    if len(a) > len(b):
        return "".join([chr(ord(x) ^ ord(y)) for (x, y) in zip(a[:len(b)], b)])
    else:
        return "".join([chr(ord(x) ^ ord(y)) for (x, y) in zip(a, b[:len(a)])])

class PaddingOracle(object):
    def query(self, q):
        target = TARGET + urllib2.quote(q)    # Create query URL
        req = urllib2.Request(target)         # Send HTTP request to server
        try:
            f = urllib2.urlopen(req)          # Wait for response
            print "correct"
        except urllib2.HTTPError, e:          
            print "We got: %d" % e.code       # Print response code
            if e.code == 404:
                return True # good padding
            return False # bad padding
    def find(self, a, b, k, txt):
        for i in range(0, 256):
            iv = a
            c1 = b
            s = chr(k);
            t = "";
            for j in range(0, k):
                t += s
            #print t
            l = 32 - k * 2
            #print iv
            #print iv[0:l]
            #print iv[0:l] + strxor(t, chr(i) + txt).encode('hex')
            q = iv[0:l] + strxor(strxor(t, iv[l:32]), chr(i) + txt).encode('hex') + c1;
            #print q
            target = TARGET + urllib2.quote(q)    # Create query URL
            req = urllib2.Request(target)         # Send HTTP request to server
            try:
                f = urllib2.urlopen(req)          # Wait for response
                print "correct" + chr(i).encode('hex')
                return i
            except urllib2.HTTPError, e:          
                #print c + " We got: %d" % e.code       # Print response code
                if e.code == 404:
                    print "404 " + chr(i).encode('hex')
                    return i # good padding
        

#if __name__ == "__main__":
po = PaddingOracle()
po.query("f20bdba6ff29eed7b046d1df9fb7000058b1ffb4210a580f748b4ac714c001bd4a61044426fb515dad3f21f18aa577c0bdf302936266926ff37dbf7035d5eeb4")       # Issue HTTP query with the given argument
po.query("f20bdba6ff29eed7b046d1df9fb7aaaa58b1ffb4210a580f748b4ac714c001bd4a61044426fb515dad3f21f18aa577c0bdf302936266926ff37dbf7035d5eeb4")       # Issue HTTP query with the given argument

om = "f20bdba6ff29eed7b046d1df9fb7000058b1ffb4210a580f748b4ac714c001bd4a61044426fb515dad3f21f18aa577c0bdf302936266926ff37dbf7035d5eeb4";
#a = om[0:32]
a = om[32:64]
b = om[64:96]
txt = ''
print txt
for k in range(1, 17):
    print k
    x = po.find(a, b, k, txt);
    txt = chr(x) + txt
    print "current text = " + txt
print "Finished execution"
#i = 0
#iv = om[0:32]
#c1 = om[32:64]
#print iv
#print iv.decode('hex')
#print c1
#print c1.decode('hex')
#q = iv[0:30] + strxor(chr(1), chr(i)).encode('hex') + c1;
#print q
#print q.decode('hex')
##po.find(tt)
#po.query(q)
##for i in range(0, 255):
##   c = chr(i).encode("hex")
##   print c
##   po.query(c)

    
